Extracted

• • Target
    dd53dbd05014bfb072243593585190cdf71ec2184817e9ad0d9d3b7390747ea4
  • Size 45KB
  • SHA256 dd53dbd05014bfb072243593585190cdf71ec2184817e9ad0d9d3b7390747ea4
  • MD5 5690b1973f46bc3c243090e955f6a0a2
  • SHA1 3c070fccd6e3aeea14962c2cc75674846611b781
  • SHA512 a80dbf940e162a48f27001ba5d71f57db7c122f1e7a892ae40ba4d1a628b9fa2ce20bb6f6dda9b7b2338db377d5faf73b8243dcb859a9a966a46c8d307af3a26
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1UxGZGP9HuPI5zjb7g63iTHwuqUvYZN5HBDZUx:cu6YepTPso2VGa353bE6STQL2YZbhdUx
  • TLSH
    T1682329003BE9822BF2BE4FB8A9F26145867AF5637503D64D1CC441DB5623FC686436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2